CN111837165A

CN111837165A - Safety system for movable barrier operator

Info

Publication number: CN111837165A
Application number: CN201880083263.XA
Authority: CN
Inventors: J·J·菲茨吉本
Original assignee: Thrall Car Manufacturing Co
Current assignee: Thrall Car Manufacturing Co
Priority date: 2017-12-21
Filing date: 2018-12-20
Publication date: 2020-10-27
Anticipated expiration: 2038-12-20
Also published as: US11122430B2; EP3729386A1; KR20200113193A; US20210385651A1; US11778464B2; WO2019126453A1; KR102652153B1; US20200236552A1; KR20240042188A; US12108248B2; CN111837165B; US20230354025A1; AU2024213144A1; CA3236659A1; CA3085470A1; CN118135696A; US10652743B2; US20190200225A1; KR102466493B1; KR20220155611A

Abstract

An electronic system for safely actuating a remote device, such as a movable barrier operator, is provided. The system solves the "man in the middle" problem of personnel intercepting and duplicating radio frequency signals from a control device by introducing timing parameters into a two-way communication sequence between at least two devices.

Description

Safety system for movable barrier operator

Cross Reference to Related Applications

This application claims the benefit of U.S. provisional patent application No. 62/608,977 filed on 21.12.2017, the entire contents of which are incorporated herein by reference.

Technical Field

The present invention relates generally to security systems that allow operation upon receipt of a suitably encoded signal. More particularly, the present invention relates to a security system or to a barrier operator system, such as a garage door operator, which employs a transmitter and a receiver that communicate via a code having at least a portion thereof that varies with operation of the transmitter.

Background

It is well known in the art to provide garage door operators or other barrier operators that include an electric motor that can be connected through a transmission to a door or other movable barrier to be opened and closed. Since many of these systems are associated with residences and garages, it is important that only persons authorized to gain access to the protected area of the barrier be allowed to open the barrier. In the past, some garage door operator systems have employed a mechanical lock and key arrangement associated with an electrical switch mounted outside the garage. While these systems enjoy a relatively high degree of tamper-resistance, they are inconvenient to use and may present a safety hazard by requiring the user to leave the vehicle to open the garage door.

It is known to provide radio controlled garage door operators which include a garage door operator unit having a radio receiver and a motor connected to a garage door. The radio receiver is adapted to receive radio frequency signals or other electromagnetic signals having particular signal characteristics that, when received, cause the door to open. Such systems may include radio transmitters that employ coded transmission of multi-valued numbers or ternary numbers (also referred to as "ternary bits"), or other serial coded transmission techniques. Among these systems is U.S. patent No. 3,906,348 to Willmott, which employs a transmitter and receiver system in which a plurality of mechanical switches may be used to set the stored authorization code.

United states patent No. 4,529,980 to Liotine et al discloses a combination transmitter and receiver for use in an apparatus such as a garage door operator, in which the transmitter stores an authorization code to be transmitted over a radio frequency link to and received by the receiver. In order to change or update the authorization code contained in the transmitter, the receiver is equipped with a programming signal transmitter or a light emitting diode that can send a digitized optical signal back to the transmitter where it is stored. Other systems that also employ coded transmission are U.S. patent nos. 4,037,201, 4,535,333, 4,638,433, 4,750,118 and 4,988,992.

While security systems have become more complex, persons who wish to gain unauthorized access to conduct property or person related crimes have also become more complex. Today, in the security industry, devices are known that can intercept or steal rolling codes.

Systems are known that include a code hopping encoder that produces a serial code having a fixed portion (i.e., that does not vary with repeated actuation of the encoded portion) and a rolling code portion that varies with each actuation of the encoded portion of the chip. To avoid that accidental activation of the transmitter when out of range of the receiver causes the transmitter rolling code to be permanently out of synchronization with the receiver and therefore unrecognizable by the receiver, these code hopping encoders provide a forward windowing system, i.e., they can be used with a system having a code receiver that recognizes as valid codes a plurality of rolling codes within a certain code window or window of values (rather than a single rolling code), which values are generated over a relatively small number of switch closings compared to the total number of rolling codes available. Examples include Keeloq model NTQ105, NTQ115, NTQ125D, and NTQ129 code hopping encoders by transequoial Technology, inc, and Mark Star TRC1300 and TRC1315 remote transmitter/receiver combinations by Texas Instruments. However, if the user leaves and inadvertently causes a code to be transmitted beyond the number of codes normally allowed in the valid forward code window, the receiver will not recognize the code and the user must circumvent the system, which may damage the system or require an engineer.

More recently, many movable barrier operators (e.g., garage door operators) use an activation code that changes after each transmission. This varying code, called the rolling access code, is created by the transmitter and acted upon by the receiver, both of which operate according to the same method to predict the next rolling access code to send and receive. One such rolling access code includes four parts: a fixed transmitter identification portion, a rolling code portion, a fixed transmitter type identification portion, and a fixed switch identification portion. In this example, the fixed transmitter identification is a unique transmitter identification number. The rolling code portion is a number that changes with each transmission to confirm that the transmission is not a recorded transmission. The fixed transmitter type identifier is used to inform the movable barrier operator of the transmitter type and characteristics. The switch identification is used to identify which switch on the transmitter was pressed, as there are systems in which the function performed differs depending on which switch was pressed.

There are also methods for pairing a remote control device with a barrier operator so that a user can purchase additional controls for use with a single barrier operator, or utilize controls integrated in a vehicle. When a movable barrier operator is installed, the premises owner will typically receive at least one handheld transmitter that has been trained to fit the operator. To operate the door from a newly learned transceiver, there is typically a two-step learning process to train the newly learned transceiver. The first step is to teach the learning transceiver the type of owner's handheld transmitter and possibly the code of the transmitter. While the owner holds the handheld transmitter several inches from the learning transceiver, while pressing the button on the learning transceiver, the button of the handheld transmitter is simultaneously pressed and held to teach the learning transceiver the type and frequency of the access code. The second step of the learning process is to train the learning transceiver to the operator. To do this, the learn button on the barrier operator must be pressed and the learning transceiver should be activated within a given time period. In another prior art method, these two steps are combined into one step or done simultaneously. In one example, a pre-trained transmitter transmits a code to the operator and the learned transceiver, both of which hold the code. Next, a button is pressed on the learned transceiver for a predetermined time to transmit a second rolling access code that is received by the operator and compared to the first rolling access code stored in the operator. The operator stores a representation of the second rolling access code from the learned transceiver if a predetermined correlation exists between the first rolling access code and the second rolling access code. According to this method, a pre-trained transmitter is required on the user to train the learned transceiver to the movable barrier operator to ensure that the user is authorized to enter the garage. Some systems even allow the universal transceiver to learn credentials from the movable barrier operator by establishing two-way communication between the universal transceiver and the movable barrier operator upon the occurrence of a predetermined event without the use of a pre-programmed transmitter.

However, there remains a need for an economical encoding system that provides enhanced security by combining the use of changing or rolling codes with additional measures to prevent or minimize interception and duplication of the codes during device use or pairing.

Disclosure of Invention

The present invention relates generally to an electronic system for providing safety for actuating a specific device. The system is useful, for example, in barrier operator systems such as garage door operators, which allow garage doors to be opened and closed in a relatively secure manner while preventing unauthorized access to the garage by personnel who may intercept radio frequency signals.

Systems and methods are provided in some forms that address the "man-in-the-middle" problem of personnel intercepting and replicating radio frequency signals from authorized devices (such as by using a "code grabber") by introducing timing parameters into a two-way communication sequence between at least two devices. The timing parameter may be, for example, a time delay or time window of a specified size or duration. If the first device communicates with the second device and a response is sent from the second device outside the time parameter, the response will be considered invalid or ignored by the first device. In this way, transmissions intercepted outside (i.e., before and after) a specified time window, which may be on the order of tens or hundreds of milliseconds, will be useless. By arranging the means to determine a time window based on the variable part of the relevant transmission (or a part or derivative thereof), the time window will vary from operation to operation and the security level is further increased.

In some embodiments, the system may include a first device configured to trigger a communication event and a subsequent response by another device. The first device may be, for example, a handheld or vehicle mounted transceiver, and may be user operated or triggered by a geo-fence, proximity detection, or other variable. Some forms of first apparatus may generally be configured for developing and transmitting a first encrypted message comprising a fixed code and a varying or variable code (e.g., a rolling code) via a wireless signal. With each actuation of the transceiver, the variable or changeable code is changed. The fixed code is static and remains the same for each actuation of the transceiver. The second device, e.g., an operator such as an electric garage door opener, receives the encrypted message, authenticates the message by comparing the fixed code and the varying or variable code to a stored value, which is preferably stored in a computer memory physically incorporated into the second device, and upon authentication sends a response signal including at least a second encrypted message having a second fixed code and a second varying code. The first device then receives and attempts to verify the second encrypted message, and in some embodiments, the first device is configured to transmit a third encrypted message to the operator device, the third encrypted message including the changed versions of the first fixed code and the second changing code. The third encrypted message is configured to cause the operator device to perform an action, such as raising or lowering a movable barrier structure.

In some forms there is provided a system for secure communication between a first device and a second device to cause the second device to act. In some embodiments, the first device includes a controller circuit; a transmitter in operable communication with the controller circuit; a receiver in operable communication with the controller circuit; and a user input device in operative communication with the controller circuit. The controller circuit of the first apparatus may be configured to: in response to detecting an input at the user input device, controlling the transmitter to transmit a first encrypted message, the first encrypted message comprising at least a first fixed code and a first varying code; receiving, by a receiver, a response from the second apparatus, wherein the response comprises a second encrypted message comprising a second fixed code and a second varying code; verifying the response by comparing the second fixed code and the second varying code with the second stored code value; and in response to the verification response, control the transmitter to transmit a third encrypted message comprising at least the changed versions of the first fixed code and the second changing code, wherein the third encrypted message is configured to cause the second apparatus to perform the action. In some embodiments, the second apparatus may include a controller circuit; a transmitter in operable communication with the controller circuit; a receiver in operable communication with the controller circuit; and a timer circuit in operative communication with the controller circuit. The controller circuit of the second apparatus may be configured to enable the receiver of the second apparatus to receive the first encrypted message; verifying the first encrypted message by comparing the first fixed code and the first varying code with the stored code value; determining when to transmit a response; controlling transmission of a response from a transmitter of the second apparatus in response to verifying the first encrypted message; enabling a receiver of the second device to receive the third encrypted message; verifying the third encrypted message by comparing the changed versions of the first fixed code and the second changed code to the stored code value; and causing an action to be performed in response to verifying the third encrypted message.

In some embodiments, at least one time window is associated with one or more encrypted messages and provides an additional layer of security and minimizes the chance that third parties will intercept transmissions and utilize the fixed and varying codes without the owner of the device agreeing. The time window may be determined with respect to a particular action, such as activation of the first apparatus, reception of a transmission by the second apparatus, etc., or alternatively may be determined based on an absolute time measurement (e.g., by determining the start and end of the window by reference to a clock). If absolute time measurements are used, the first device and the devices with which it communicates should be synchronized so that their absolute time measurements are substantially the same. In some such embodiments, the first and second devices each comprise a timer in operative communication with their respective controller circuits, and upon actuation, the first device determines a time window in addition to transmitting a first encrypted message comprising at least a first fixed code and a first varying code to expect receipt of a response within the time window. In some embodiments, the time window may be determined based on one or more code portions used to create the first encrypted message (e.g., a changing code portion of the message or one or more portions thereof) or based on an encrypted form of the message or one or more portions thereof. The second device receives and decrypts the first encrypted message and verifies the message by comparing its fixed and varying or variable codes to the stored value. The second device also determines a second time window based on the encrypted message to transmit the response to the user-operated transceiver in the second time window. The second time window may be the same as or within the time window determined by the first apparatus and may or may not be determined using the same portion of the encrypted message. The second time window may be a discrete point in time within the first time window.

In some embodiments, the second device sends a response signal to the first device within the second time window after the second device verifies the first encrypted message. The response signal includes at least a second encrypted message created from a second fixed code and a second varying code, which may, but need not, be independent of the first varying code. If the second encrypted message is received by the first device within the first time window, the first device will attempt to authenticate the second encrypted message by comparing the fixed code and the varying or variable code of the second encrypted message to a set of stored code values. In some embodiments, the first device may compare the time of receipt of the second encrypted message to a first time window and only continue to analyze signals or messages received within the first time window. Alternatively, to conserve power, the first apparatus may turn on and enable the receiver element at the beginning of the time window and turn off the receiver element at the end of the time window, such that the first apparatus is only able to receive transmissions from the second apparatus within the first time window. In such an embodiment, if the second encrypted message is sent and received outside the first time window, it will be ignored entirely. Once the response from the second apparatus is verified, the first apparatus in some embodiments may be configured to transmit third encrypted information that includes the changed versions of the first fixed code and the second change code. The third encrypted message is configured to cause the second device to perform an action, such as raising or lowering a movable barrier.

The fixed and variable codes may be of any selected length and may be modified or changed in various ways to add additional layers of security. In some examples, the transmitter may be configured to generate a frame comprising a specified number of bits of the fixed portion of the code and a second frame comprising the variable portion of the code. In some embodiments, the variable portion of the code (which may be a rolling code) may then be mirrored to provide a mirrored rolling code. The mirrored rolling code can then be "deleted" by setting its most significant bit to zero. The transmitter may then convert the fixed code and the mirrored rolling code into a ternary or ternary fixed code and a ternary or ternary rolling code. To provide further security, in some embodiments, the fixed and rolling codes may be shuffled or interleaved such that alternating bits consist of fixed and rolling code bits. A single synchronization and/or identification pulse may advance the first and second frames to indicate the start of the frame and whether it is the first or second frame.

Additionally or alternatively, in some embodiments, encrypting may include providing the variable code and a plurality of different data bit order patterns, providing a plurality of different data inversion patterns, selecting a particular one of each of the data bit order patterns and the data inversion patterns to provide a selected pattern, and transmitting at least a portion of the encrypted variable code using the selected pattern as a transmission characteristic. In some forms selecting a particular one of each of the data bit order pattern and the data inversion pattern to provide a selected pattern includes using a variable code to select the particular data bit order pattern and the data inversion pattern to provide the selected pattern.

A method of pairing a first device and a second device to establish secure communication between the first device and the second device to cause an action by the second device is also provided. The first device transmits a first encrypted message to the second device, the first encrypted message including at least a first fixed code and a first varying code. The first apparatus optionally also determines a time window in which to expect a response from the second apparatus, and the time window may be based on at least a portion of the first encrypted message. In some embodiments, the first device may enable the first device receiver to receive the response from the second device during the time window, or alternatively, the first device receiver may remain in an on state and compare a timestamp of the response to the time window. The second device receives the first encrypted message when the second device is in a "learn" mode in which the second device is waiting for a signal from the transmitter without information about the current version of the change code of the first device. While in the learning mode, the second device stores the first encrypted message and determines a time window in which to transmit a response to the first encrypted message. In some embodiments, the second device may have been manually placed into the learning mode by the user, such as by pressing a button, switch, or joystick on the second device, thus in some embodiments it may be desirable to manually activate both the first and second devices. The time window determined by the second apparatus may depend on one or more portions of the first encrypted message. The second device transmits its response to the first device within a time window determined by the second device, the response including a second encrypted message including at least a second fixed code. When the first device receives a second encrypted message of the response within the time window determined by the first device, the response is stored and the first device transmits a third encrypted message back to the second device, the third encrypted message including at least the first fixed code and the changed version of the first changed code. The second device receives the third encrypted message and verifies it by comparing the first fixed code and the changed version of the first changing code with the stored code value from the first encrypted message (the first fixed code and the first changing code), and upon verification (by confirming that the changed version of the first changing code is a forward change of the changing code from the first encrypted message), the second device then transmits a fourth encrypted message comprising the second fixed code and the second changing code (which may be independent of the first changing code). The first device receives the fourth encrypted message, verifies the fourth encrypted message by comparing the second fixed code and the second varying code to the response stored by the first device, and stores the second fixed code and the second varying code in response to verifying the fourth encrypted message.

The present system provides advantages over previous garage door operator systems and previous rolling code systems. Some systems according to the present invention provide enhanced security through two-way communications in which both the first and second devices transmit and receive independent codes to verify transactions between the devices on the user side and the operator side. Some embodiments provide enhanced security by linking information about the timing of subsequent transmissions to encrypted transmissions, and require that responsive transmissions be received within a specified time window as a prerequisite to code verification. These enhanced security measures may also be used in methods of pairing and/or synchronizing devices.

Drawings

FIG. 1 is a perspective view of an exemplary movable barrier operator system receiving control signals from a user-operated transceiver;

FIG. 2 is a block diagram of an example of the user-operated transceiver of FIG. 1;

FIG. 3 is a block diagram of an example of a movable barrier operator of the system of FIG. 1;

4A-C are flowcharts illustrating exemplary communication flows between a first device and a second device during normal operation;

5A-C are flow diagrams illustrating an example communication flow between a first device and a second device during a learning or pairing sequence;

FIG. 6 is a timing diagram of an example of a signal generated by a portion of a transmitter of one of the first and second apparatuses;

7A-C are flow diagrams illustrating examples of operation of a transmitter;

8A-F are flow diagrams illustrating an example of the operation of a receiver of one of the first and second apparatuses;

FIG. 8G is a schematic diagram of one example of bit processing used in encrypting messages;

FIG. 8H is a message diagram according to an example of an encrypted message;

9A-C are flow diagrams illustrating another example communication flow between a first device and a second device during normal operation;

fig. 10A-C are flow diagrams illustrating another example communication flow between a first device and a second device during a learning or pairing sequence.

Skilled artisans will appreciate that elements in the figures are illustrated for simplicity and clarity and have not necessarily been drawn to scale. Common but well-understood elements that are useful or necessary in a commercially feasible embodiment may be omitted for simplicity and/or clarity. It will also be appreciated that certain actions and/or steps may be described or depicted in a particular order of occurrence while those skilled in the art will understand that such specificity with respect to sequence is not actually required.

Detailed Description

The systems and methods described herein include a user-actuated first device, such as a handheld or vehicle-mounted transceiver, that is generally configured to form a first encrypted message that includes a fixed code and a variable or variable code (e.g., a rolling code). With each actuation of the transceiver, the variable or variable code changes according to a sequence or protocol of settings accessible by the first device and the second device with which it communicates. The fixed code remains the same for each actuation of the first device. The second device includes an operator mechanism, such as a garage door opener, to initiate one or more actions when commanded by the first device. The first and second devices may be configured to communicate with each other through various technologies, such as wired communication paths, radio frequencies, or any of various proprietary wireless platforms.

In some embodiments, the second device receives an encrypted message from the first device, authenticates the message by comparing the fixed code and the varying or variable code to a stored value, and upon authentication, transmits a response signal including at least a second encrypted message having a second fixed code and a second varying code independent of the first varying code. The stored values may represent, for example, fixed values and varying values from previous operations, where a sequence or algorithm associated with the varying code determines the varying code value. In some embodiments, the second device may identify the plurality of change code values as valid to account for accidental or invalid actuation of the first device (e.g., when out of range of the second device, or when interference prevents normal communication with the second device).

The first device receives and attempts to verify the second encrypted message, and in some embodiments, the first device is configured to transmit a third encrypted message to the second device, the third encrypted message including a changed version of the first fixed code and the second changed code. The third encrypted message is configured to cause the second device to perform an action, such as raising or lowering a movable barrier. Thus, communication between devices may involve two-way authentication of messages, where each of the two devices is configured to both transmit and receive messages and compare them to a stored value, such as a value from a previous communication between the devices. In some embodiments, the communication between the devices may involve additional message exchanges in order to further improve security, e.g. transmitting and verifying fourth and fifth encrypted messages containing fixed and changing codes.

In some embodiments, at least one time window is associated with the encrypted message to provide an additional layer of security and to minimize the chance that third parties will intercept transmissions and utilize the fixed and varying codes without the owner of the device agreeing. In some such embodiments, upon actuation, the first device also determines a time window in which to expect a response to be received when it transmits a first encrypted message comprising at least a first fixed code and a first varying code. In some embodiments, the time window may be determined based at least in part on encrypting one or more portions of the message, such that the time window itself acts as an additional layer of encryption. For example, a particular length of time may be associated with a particular value or number in a fixed code portion of a message, such that a particular time window is linked to the first device, or with a particular value or number in a varying code portion of a message, such that the time window varies with each actuation of the first device. The second device receives the encrypted message and authenticates the message by comparing the fixed code and the varying or variable code to the stored value. The second device then determines a second time window based on the encrypted message to transmit the response to the user-operated transceiver in the second time window, the second time window being the same as or within the time window determined by the first device and may or may not be determined using the same portion of the encrypted message. In some embodiments, the second time window may be a discrete point in time with or without error margin that lies within the first time window.

The second device transmits a response signal within a second time window when the second device verifies the encrypted message. The response signal comprises a second encrypted message, which may be, for example, a message comprising a second fixed code and a second varying code independent of the first varying code. The first device may be configured to ignore responses received by the first device outside the first time window, but to verify responses received within the time window calculated by the first device, thereby allowing the timing of the response signal from the second device to act as an additional layer of security verifying that the devices are authorized to communicate with each other. If the second encrypted message is received by the first device within the first time window, the user-operated device will verify the second encrypted message by comparing the fixed code and the varying or variable code of the second encrypted message to a set of stored code values. The first device may compare the time of receipt of the second encrypted message to the first time window and only continue to analyze signals received within the first time window. Alternatively, to save power, the first device transceiver may be turned on and enable the receiver portion to receive transmissions only within the first time window, such that if a second encrypted message is sent and received outside the first time window, it will be ignored entirely. In some embodiments, the time window is less than about 360 milliseconds, and in some embodiments, the time window begins tens or hundreds of milliseconds after it is determined by the first device. The time window is preferably short enough that there is no significant delay for the user between actuating the transmitter device and causing the requested action.

Upon verifying the response from the second apparatus, the first apparatus may be configured to transmit a third encrypted message, e.g., a third encrypted message including a changed version of the first fixed code and the second changed code. The third encrypted message is configured to cause the operator device to perform an action, such as raising or lowering a movable barrier structure. In some embodiments, the third message may also be associated with a time window and identified by the second device only when received within the calculated time window. The devices may also be configured to require authentication of the additional message before causing the second device to act.

Referring now to the drawings, and more particularly to fig. 1, a movable barrier operator system 10 is provided that includes a movable barrier operator 12 mounted within a garage 14 and a handheld transceiver 30. The operator 12 is mounted to a ceiling 16 of the garage 14 and includes a track 18 extending therefrom, the track 18 having attached thereto a releasable trolley 20 having an arm 22 extending to a multi-panel garage door 24, the arm 22 being positioned for movement along a pair of door tracks 26 and 28. The handheld transceiver unit 30 is adapted to transmit signals to and receive signals from the operator 12. An antenna 32 may be positioned on the operator 12 and coupled to a receiver as discussed below in order to receive transmissions from the handheld transceiver 30. An external control panel 34 may also be located outside of the garage 14, having a plurality of buttons thereon, and communicating with the antenna 32 of the operator 12 via radio frequency transmission. Optical emitter 42 may be connected to operator 12 by power and signal line 44 and optical detector 46 is connected to operator 12 by electrical line 48 to prevent door 24 from closing on a person or object that is inadvertently in the path of the door. A switch 300 may be provided for switching between modes such as an operating mode and a learning mode.

Referring now to fig. 2, a block diagram of a transceiver 30 is provided. The transceiver 30 includes a transmitter 206 and a receiver 207 (which may be combined into a single mechanism) in operative communication with

antennas

220 and 221, respectively. The antenna may be positioned in, on, or extending from the user-operated transceiver 30, wherein the transmitter 206 and receiver 207 are configured to wirelessly transmit and receive transmission signals, including a transmission signal containing a first rolling access code having a fixed code portion and a rolling code portion, to and from the movable barrier operator 12. In some embodiments, both the transmitter and the receiver may be in communication with a single antenna or multiple antennas, and in some embodiments, both devices may be configured as a single transceiver device in communication with a single antenna. The user-operated transceiver 30 also includes a controller 202 in operable communication with the transmitter 206 and the memory 204, and is configured to process data and execute commands. The memory may be, for example, a non-transitory computer-readable medium and may store thereon instructions that, when executed by the controller circuit, cause the controller circuit to perform operations. The power source 205 is coupled to the controller 202 and/or other components, and in some embodiments may be routed such that the switch 31 couples/decouples the power source to the other components such that power is only provided when the switch 31 is activated or at a designated time thereafter. The controller 202 is configured to generate and cause the transmitter 206 to transmit a first rolling access code comprising at least one fixed code portion and at least one varying or rolling code portion for transmitting a signal, and the receiver 207 is configured to receive a responsive transmission. A timer 230 in communication with the controller 202 provides a way to determine when the input and output signals are transmitted and provides a reference for the controller 202 to enable and disable the transmitter 206 and/or receiver 207 of the device. The memory 204 is connected for operable communication with the controller 202 and is configured to store code and, in some embodiments, other information for output transmission. Memory 204 is also configured to store fixed code values and/or variable code values for comparison with incoming transmissions. The switch 31 may comprise one or more user operable switches for inputting commands to the transceiver 30, for example issuing barrier movement commands or learning commands. The switch 31 may be associated with a button, joystick or other device to be actuated, for example, by a user's hand or other action, event or condition. As other examples, the switch 31 may be voice-operated, or may be operated by a user contacting a touch-sensitive screen as a position of an object displayed on the touch-sensitive screen.

Referring now to fig. 3, in one example, the operator 12 includes a controller 302 in communication with a memory 304 and is configured to store data to and retrieve data from the memory 304, as well as process data and execute commands. A power source 305 (e.g., an AC power conduit, battery, or other known power source) provides power to the controller 302 to allow operation. The operator 12 also includes a wireless transmitter 306 and receiver 307 (or combination device) in operable communication with the controller 302. As shown, the transmitter 306 is in communication with a first antenna 320 and the receiver is in communication with a second antenna 321, but both devices may be in communication with a single antenna or multiple antennas, and in some embodiments the device may be configured with a single transceiver device in communication with a single antenna. The antenna may be positioned within the movable barrier operator 12, on the movable barrier operator 12, or extend from the movable barrier operator 12. In this regard, signals such as radio frequency or other wireless transmission carriers may be transmitted to and received from the user-actuated transceiver 30 according to various frequencies or modulations. The signal may be modulated in a number of different ways; accordingly, the transceiver 30 and the movable barrier operator 12 may be configured to communicate with each other via a variety of techniques. Controller 302 of operator device 12 also communicates with motor 340 to perform operations such as raising or lowering a garage door; sliding, swinging or revolving doors; or otherwise move or reposition the barrier structure. One or more switches 331 may be provided to override (override) the controller 302 or place the controller in or out of a learn mode in which the operator 12 may be paired with a user-operated device by exchanging and storing messages.

The term controller broadly refers to any microcontroller, computer, or processor-based device having a processor, memory, and programmable input/output peripherals, which are generally designed to manage the operation of other components and devices. It will also be appreciated that it includes the usual accompanying accessory devices. The controller may be implemented by one or more processors, microprocessors, central processing units, logic, local digital storage, firmware, software, and/or other control hardware and/or software, and may be used to perform or assist in performing the steps of the processes, methods, functions, and techniques described herein. Further, in some embodiments, the controller may provide multi-processor functionality. These architectural choices are well known and well understood in the art and need not be described further herein. The controller may be configured to perform one or more of the steps, actions and/or functions described herein (e.g., through the use of corresponding programs stored in memory, as will be readily understood by those skilled in the art).

In general, the

controllers

202 and 302 may be similarly or independently configured, and each controller may comprise a fixed-purpose, hard-wired platform, or may comprise a partially or fully programmable platform. These architectural choices are well known and well understood in the art and need not be described further herein. The controller may be configured (e.g., by using corresponding programming as would be well understood by those skilled in the art) to perform one or more of the steps, actions, and/or functions described herein, and may store instructions, code, and the like, which are executed by the controller and/or processor to achieve the desired functionality. In some applications, the controller and/or memory may be distributed over a communication network (e.g., LAN, WAN, internet) that provides distributed and/or redundant processing and functionality. In some embodiments, the controller may include a processor and a memory module (such as in a microcontroller) integrated together. One or more power supplies may supply power to each controller and may be of any known type.

When the user actuates switch 31 of the user-operated transceiver 30 (e.g., by pressing a button designated to perform a particular action), the controller 202 activates the transmitter 206 to transmit a message via antenna 220 based on information stored in the memory component 204. The message is received by the receiver 307 of the operator device 12 and transmitted to the controller 302 of the operator. In some embodiments, the controller 302 validates the message by comparing it to stored information from the operator's memory module 304, and once validated, the controller 302 is configured to cause a response signal to be transmitted from the transmitter 306 through the antenna 320. If the message from the user-actuated transceiver 30 includes information relating to the timing parameters for the response, the controller 302 of the operator receives time information from the timer 330 in order to determine when to transmit the response in order to comply with the timing parameters of the user-actuated transceiver 30.

The user-actuated transceiver 30 may be configured to verify that the response from the operator 12 meets the transmitted timing requirements in any number of ways. In some embodiments, the controller 202 may compare a timestamp or other timing information related to the operator's response to the transmitted time parameter using the timer 230. In some embodiments, the receiver 207 is normally inactive, but is only turned on by the controller 202 for a short period of time that is consistent with the transmitted timing parameters. For example, the controller 202 may open the receiver 207 for a time window that matches the time window transmitted in the outgoing message by the transmitter 206, and upon expiration of the time window according to the timer 230, the controller 202 again closes the receiver 207. The timing information can be either relative, such as a specified number of seconds, milliseconds, or nanoseconds after the transmission of an output signal or other event, or absolute, such as standard date and time information for a particular time zone.

Once the response of operator 12 is received by receiver 207 at the appropriate time consistent with the specified timing parameters, user-actuated transceiver 30 may verify the response by comparing it to the stored information in its memory module 204. Once the response is verified, the user-actuated device 30 may transmit another message to the operator 12 via the transmitter 206. The third message is configured to cause the operator's controller 302 to actuate the motor 340 in order to perform the function associated with the actuation of the user-actuated device. Transceiver 30 may include a plurality of buttons, joysticks, switches, displays, microphones, speakers, or other inputs associated with different tasks to be performed by operator 12.

In another example, the movable barrier operator 12 may be paired with a user-actuated transceiver. The receiver 307 of the operator 12 is configured to receive an authorization signal indicating that it is authorized to communicate with the user-actuated transceiver 30 and to provide an indication to the controller 302 that it received the authorization signal. One or more switches 331 may be provided to open and/or otherwise allow the receiver 307 to receive the authorization signal. In response to receiving the authorization signal, the controller 302 is configured to generate a first rolling access code and store a representation of the first rolling access code in the memory device 304. The controller 302 is configured with a transmitter 306 to transmit a transmission signal comprising a first scrolling access code to the user actuated device 30. The receiver 307 also receives a transmission signal including a second rolling access code from the user-actuated transceiver 30, as further described below. In this example, the receiver 307 provides a transmission signal to the controller 302, and the controller 302 compares the second rolling access code to a representation of the first rolling access code stored in the memory device 304.

Fig. 4A, 4B and 4C are flow diagrams of interconnections showing steps of one example of a process in which signals are exchanged between first and second devices to verify authorization and perform activities. The steps to the left of the central dashed line relate to a first device, such as a user operated remote device, and the steps to the right relate to a second device, such as a movable barrier operator. For example, the first and second devices may be the transceiver 30 and the operator 12 previously discussed. In this example, a previous operation, such as a pairing procedure or sequence of operations, has been performed at an earlier time, such that each of the first and second apparatuses has stored information received from the other apparatus; the first operation of the device in the form of a pairing or synchronization sequence will be further explained below in connection with fig. 5A-5C.

Initially, both the first and second devices have stored in their memories a first fixed code and a first variable code from a previous operation involving the first device, and a second fixed code and a second rolling code from a previous operation involving the second device. The first device evaluates 401 whether it has been activated in a manner intended to cause the second device to act. For example, a user pressing a button on the first device may complete a circuit or cause a measurable change to at least one component of the first device. When the first device has not been activated, it will continue to wait for activation. Once activated, the first device transmits 403 a first message comprising at least a first fixed code and a first varying or variable code, which represents a modification of the first varying code in a previous operation. The first fixed code and/or the first variable code is now stored in the memory of the first device and may be encrypted using one or more encryption methods. The encryption method is not particularly limited, and may include one or more types of public or private key encryption, block cipher, stream cipher, and other techniques. In some embodiments, encryption may include the use of a predetermined number of bits of varying codes as a basis for selecting a particular data bit order pattern and a particular data inversion pattern. The first device also calculates 405 a time window in which it expects to receive a response, and this calculation may be done before or after the first device transmits the message. In some embodiments, the time window is calculated from at least a portion of the first encrypted message or from at least a portion of the unencrypted variable code, or from both.

At the same time, the second device has been placed in an operational mode and waits 402 for a signal to cause an action and, upon receiving 404 a first message from the first device, decrypts the message to obtain a first fixed code and a first variable code. The second device then stores the first fixed code and the first variable code and verifies the first fixed code and the first variable code by comparing 406 them to the stored code value. In this step, the first fixed code and the first variable code from the encrypted message are compared with the first fixed code and the variable code from the previous operation. A first encrypted message will be considered authenticated if the fixed codes match and the first variable code from the encrypted message matches a previous variable code modified according to a set of established variable code rules (e.g., matches a subsequent value from a predetermined sequence or algorithm). If the decrypted code value does not match the stored code value, the second device ignores the first message and waits 402 for additional signals. On the other hand, if the code value is valid in 407, the second device calculates 408 a response time window, such as a particular window or point in time, based on the first encrypted message. The response time may or may not be the same as the response window calculated 405 by the first device and may or may not use the same portion or portions of the first encrypted message and/or the first variable code. For example, the second device may use the same plurality of portions of the first fixed and/or first variable code to calculate the same time window calculated by the first device, or may be configured to read one or more portions of the first fixed or variable code to determine a response time that is entirely within the window calculated by the first device.

In response to verifying the first encrypted message, and after determining the response time window, the second device transmits a response 410 within the time window calculated in 408. The response includes a second encrypted message that includes a second fixed code and a second variant/variable code that, in the described embodiment, is independent of the first variant code and represents a modified version of the variable code from a previous operation. The second fixed code value and the modified second variable code value are stored in a memory of the second device, so at this stage the second device memory contains the first fixed and variable codes from the previous operation, the second fixed and variable codes from the previous operation, the first fixed and variable codes in the first encrypted message from the first device, and the second fixed and variable codes from the encrypted response.

The first device enables 409 the receiver during the time window calculated by the first device so that it can receive the encrypted response from the second device. If the second device sends a response outside the time window calculated by the first device, the signal will not be received at all because the first device receiver is turned off. However, if the second device sends a response during the calculated time window (in which the first device receiver is active), the first device will receive 411 and decrypt a second encrypted message that includes the second fixed code and the second varying/variable code. The second fixed code and the varying variable code are stored in a memory of the first device together with the second fixed and variable codes from the previous operation and the first fixed and variable codes from the first encrypted message. The first code from the previous operation is no longer needed and can be deleted from memory.

The first device then compares 412 the second fixed code and the second variable/change code to the fixed code and the variable code from the previous operation stored in the memory of the first device. The response message is validated if the second fixed code matches the fixed code from the previous operation and the second variable code matches the previous variable code modified according to a set of established variable code rules. If it is determined 413 that the second fixed code and the variable code are valid, the first device transmits 414 a third encrypted message that includes at least the changed versions of the first fixed code and the second changed code. If the first device is unable to verify the response from the second device, the flow ends and the first device returns to waiting 401 for a subsequent activation.

When the second device receives 415 the third encrypted message, the second device decrypts 415 the message to determine the changed versions of the first fixed code and the second variable code. These values are stored in the second device memory, which now contains the first fixed and variable codes from the previous operation, the first fixed and variable codes from the first encrypted transmission, the second fixed and variable codes from the previous operation, the second fixed and variable codes from the second encrypted (response) transmission, and the first fixed codes and the varying second variable codes from the third encrypted message. The second device then compares 416 the changed version of the first fixed code and the second variable code to a stored code value comprising the first fixed code and the unmodified second variable code to verify 417 the third encrypted message. Although the verification step may have a forward window of acceptable value (verification will occur when the received version of the change code is any one of the next several (e.g., 12) values expected in the sequence), security may be improved by reducing the size of or eliminating the forward window altogether. Thus, in some embodiments, the third encrypted message is only verified when it contains the next variable code value in the sequence. If the third message is verified, the second device performs 418 the requested action associated with the activation of the first device. If the second device is unable to verify the third message, the second device ends the flow without performing the requested action and returns to waiting 402 for a signal from the first device.

Turning now to fig. 5A-C, a flow diagram illustrates an example method of pairing a first device to a second device to synchronize, for example, a user-actuated device and an operator device for identifying and verifying a signal shared between the devices. The first device may be the transceiver 30 and the second device may be the operator 12 previously discussed. The method involves at least one apparatus learning a varying code sequence from another apparatus, and in some embodiments may involve two-way learning, such that each apparatus receives and stores a series of fixed code values and varying code values from another apparatus. In some embodiments, the devices may be configured such that the pairing method requires manipulation of a button or other actuator on each device, for example pressing a button on the garage door operator to place the device in a learn mode, and then pressing a button on the remote control device to initiate the pairing process.

In one form, the pairing method begins when the user activates 451 the first device while the second device has been placed 452 in a "learn" mode (e.g., by pressing a button or switching a joystick that is on or associated with the second device). First, the first device contains a first fixed code and a first variable code in its memory, and the second device contains a second fixed code and a second variable code. When the first device is activated, it transmits 453 a first encrypted message from the first device (the first encrypted message comprising at least a first fixed code and a first varying or varying code), and determines 455 a time window based on at least a portion of the first encrypted message in which to expect a response from the second device. The first device receiver is enabled 456 during the time window to receive a response from the second device. Meanwhile, the second device receives 454 the first encrypted message while the second device is in the learn mode and stores 457 the decrypted first fixed and first variable codes from the first encrypted message or portion thereof in a memory of the second device. The second device determines 458 a time window based on the first encrypted message to transmit the response in the time window. The second apparatus then transmits 459 a response within the time window, the response comprising a second encrypted message comprising a second fixed code from the second apparatus. If the first device receives 460 the second encrypted message within the time period calculated by the first device for the response, the second message is decrypted and the first device stores 461 a second fixed code. If no response is received from the first device within the time window, the message will be ignored and the pairing process stops.

After receiving the response from the second device within the time window and storing the associated value, the first device then transmits 462 a third encrypted message comprising at least the first fixed code and the altered version of the first variable code. The first device also enables 463 the receiver of the first device, in anticipation of receiving further communications from the second device. In some embodiments, this step of enabling 463 reception in the first device may include an associated time window derived from the third message.

When the second device receives 464 and decrypts the third encrypted message, the second device verifies the message by comparing 465 the changed versions of the first fixed code and the first variable code with the stored code value from the first encrypted message. If the second device determines 466 that the comparison is valid, the second device transmits 467 a fourth encrypted message that includes the second fixed code and the second varying code from the memory of the second device in response to verifying the third encrypted message.

The first device receives 468 the fourth encrypted message and verifies the fourth message by comparing 469 the second fixed code and the second varying code to the response stored by the first device. If the fourth message is determined 470 to be valid, the first device stores 471 a second fixed code and a second varying version of the second variable code in response to verifying the fourth encrypted message.

The variable or varying code transmitted by the first and second devices may be selected from those known in the art, such as a rolling code system, wherein the varying code is modified based on a preset algorithm and/or a predefined list or sequence of numbers. When a device verifies a change code by comparing it to a stored value, the device will typically compare the received code value to a number of expected subsequent values to account for activation of one device out of range of another device that otherwise would not result in communication with the other device. For example, in some embodiments, the apparatus will compare the received change code to at least twelve stored values, and in some embodiments, to at least 24, 48, 96, 128, or 256 stored values.

The fixed and varying codes for each message transmitted between devices may be encrypted and/or decrypted using a variety of methods and/or algorithms. In some forms the first device transmits the encrypted signal for operation or control of the second device by generating a radio frequency oscillating signal, generating a variable binary code, generating a ternary/ternary code responsive to the variable binary code, and modulating the radio frequency oscillating signal with the ternary code to produce a modulated ternary encoded variable radio frequency signal. To provide further security, in some embodiments, the fixed and rolling codes may be shuffled or interleaved such that alternating ternary bits are comprised of fixed and rolling code bits to produce, for example, a total of 40 ternary bits. The 40 ternary bits may then be packed in a first 20 ternary bit frame and a second 20 ternary bit frame. A single synchronization and/or identification pulse may advance the first and second frames to indicate the start of the frame and whether it is the first or second frame. The signal may be configured to comply with local laws and regulations; for example, immediately after each frame, the first device may be placed in a quiet state to maintain the average power of the transmitter at typical 100 millisecond intervals and within local regulations (e.g., within legal limits promulgated by the federal communications commission in the united states). The first ternary frame and the second ternary frame may be used to modulate a radio frequency carrier (e.g., via amplitude modulation) to produce an amplitude modulated encrypted signal. The amplitude modulated encrypted signal may then be transmitted and may be received by the second apparatus.

In some embodiments, the second device receives the amplitude modulated encrypted signal and demodulates it to produce a pair of ternary bit encoded frames. The ternary bits in each frame may be converted in substantially real time to 2-bits or nibbles indicating the value of the ternary bits, which may ultimately be used to form two 16-bit fixed codewords and two 16-bit variable codewords. These two 16-bit fixed code words may be used as pointers to identify the location of previously stored variable code values within the operator. Two 16-bit rolling codewords can be concatenated by taking the 16-bit word with the more significant bits, multiplying it by 310, and then adding the result to the second word to generate a 32-bit encrypted variable code. The 32-bit encrypted code may then be compared to the stored variable code by binary subtraction. If the 32-bit code is within a window or fixed count, the microprocessor of the second device may generate an authorization signal, and then the other portions of the circuitry of the second device may respond to the authorization signal, thereby causing the garage door to open or close as commanded. If the code is greater than the stored rolling code plus a fixed count (which represents a relatively large incremental number), the user may be allowed to provide other signals or indicia to the receiver to establish authorization, rather than being locked, which does not significantly reduce security. This may be done by the receiver entering an alternative mode using two or more consecutive active codes to be received (instead of just one). If two or more consecutive valid codes are received in this example, the operator will be actuated and the garage door will open. However, in such embodiments, to prevent a person who previously or recently recorded the most recent valid code from being able to gain access to the garage, the tail window is compared to the received code. If the received code is within this tail window, the system responds by simply not taking any further action, nor providing authorization during the code period, as this indicates that the code has been stolen.

Fig. 6-8 illustrate one potential encryption/decryption scheme. Fig. 6 is an example of a ternary code that is actually used to modify a radio frequency oscillating signal. In the depicted example, the bit timing of 0 is a fall time of 1.5 milliseconds and a rise time of 0.5 milliseconds, the bit timing of 1 is a fall time of 1 millisecond and a rise time of 1 millisecond, and the bit timing of 2 is a fall time of 0.5 millisecond and a rise time of 1.5 milliseconds. The rise time is actually the active time at which the carrier is generated. The fall time is an inactive time at which the carrier is switched off. The code is assembled in two frames, each frame having 20 ternary bits, where the first frame is identified by a 0.5 millisecond sync bit and the second frame is identified by a 1.5 millisecond sync bit.

Referring now to fig. 7A-7C, a flow chart is presented describing a form of generating a rolling code encrypted message from a first device to be transmitted to a second device. In step 500, the rolling code is incremented by three and then stored 502 for the next transmission from the device when the button is pressed. The order of the binary digits in the rolling code is reversed or mirrored at step 504, and the most significant bits are then converted to zeros at step 506, effectively truncating the binary rolling code. The rolling code is then changed to ternary code with

values

0,1 and 2 and the initial ternary rolling code bit is set to 0. In some forms, a ternary code is actually used to modify the radio frequency oscillating signal, and an example of a ternary code is shown in fig. 6. It is to be noted that, in fig. 6, the bit timing of 0 is a falling time of 1.5 msec and a rising time of 0.5 msec, the bit timing of 1 is a falling time of 1 msec and a rising time of 1 msec, and the bit timing of 2 is a falling time of 0.5 msec and a rising time of 1.5 msec. The rise time is actually the active time at which the carrier is generated or transmitted. The fall time is an inactive time at which the carrier is switched off. The code is assembled in two frames, each frame having 20 ternary bits, where the first frame is identified by a 0.5 millisecond sync bit and the second frame is identified by a 1.5 millisecond sync bit.

In step 510, the next highest power of3 (next highest power of3) is subtracted from the rolling code and a test is made in step 512 to determine if the result is greater than zero. If so, the next most significant bit of the binary rolling code is incremented in step 514, and the method returns to step 510. If the result is not greater than 0, the next highest power of3 is added to the rolling code in step 516. In step 518, another highest power of3 is increased, and in step 520, a test is determined as to whether the rolling code is complete. If false, control loops back to step 510. If the rolling code is complete, step 522 clears the bit counter. In step 524, the blanking timer is tested to determine if it is in an active state. If not, the bit counter is incremented in step 532. However, if the blank timer is active, then a test is made in step 526 to determine if the blank timer has expired. If the blank timer has not expired, control is transferred to step 528 where the bit counter is incremented and control is then transferred back to decision step 524. If the blank timer has expired, as measured in decision step 526, the blank timer is stopped in step 530 and the bit counter is incremented in step 532. The bit counter is then tested for odd or even numbers in step 534. If the bit counter is not even, control is transferred to step 536 where the divide-by-2 output bit of the bit counter is fixed. If the bit counter is even, the divide-by-2 output of the bit counter is scrolled in step 538. The bit counter is tested to determine if it is set equal to 80 in step 540-if yes, a blank timer is started in step 542, but if not, the bit counter is tested to be equal to 40 in step 544. If so, the blank timer is tested and started in step 546. If the bit counter is not equal to 40, control is transferred back to step 522.

Referring now to fig. 8A-8F, and in particular fig. 8A, one example of the processing of an encrypted message from a first device by a second device is given. In step 700, an interrupt is detected and operated on. The time difference between the last edges is determined and the radio inactivity timer is cleared in step 702. It is determined in step 704 whether this is an active time or an inactive time, i.e. whether a signal is being transmitted with the carrier. If this is an inactive time, indicating no carriers, then control is transferred to step 706 to store the inactive time in memory and the routine is exited at step 708. If it is an active time, the active time is stored in memory in step 710 and the bit counter is tested in step 712. If the bit counter is zero, control is transferred to step 714, as best seen in FIG. 8B, and a test is made to determine if the inactivity time is between 20 and 55 milliseconds. If not, the bit counter and the rolling code register and fixed code register are cleared at step 716, and the routine exits at step 718.

If the inactivity time is between 20 and 55 milliseconds, a test is made in step 720 to determine if the activity time is greater than 1 millisecond, as shown in FIG. 8C. If not, a test is made in step 722 to determine if the inactivity time is less than 0.35 milliseconds. If so, a frame 1 flag is set in step 728, the input information is identified as being associated with frame 1, and the interrupt routine is exited in step 730. In the event that the active time test is not less than 0.35 milliseconds in step 722, the bit counter and the rolling code and fixed registers are cleared in step 724 and the return is exited in step 726. If the active time tested in step 720 is greater than 1 millisecond, a test is made in step 732 to determine if the active time is greater than 2.0 milliseconds, and if not, the frame 2 flag is set in step 734 and the routine is exited in step 730. If the active time is greater than 2 milliseconds, the bit counter rolling code register and fixed code register are cleared in step 724 and the routine is exited in step 726.

In the event that the bit counter test indicates that the bit counter is not 0 at step 712, then control is taken to set 736, as shown in FIG. 8A. The active and inactive periods are tested to determine if they are both less than 4.5 milliseconds. If any period is not less than 4.5 milliseconds, the bit counter and the rolling code register and fixed code register are cleared. If both are equal to or greater than 4.5 milliseconds, then in step 738, the bit counter is incremented and the active time is subtracted from the inactive time, as shown in FIG. 8D. In step 740, it is determined whether the result of the subtraction is less than 0.38 milliseconds. If they are bit values, then the bit values are set equal to zero in step 742, and control is transferred to decision step 743. If the result is not less than 0.38 milliseconds, a test is made in step 744 to determine if the difference between the active time and the inactive time is greater than 0.38 milliseconds, and control is then transferred to step 746 where the bit value is set equal to 2. Both bit values set in

steps

742 and 746 involve a conversion from three-level

ternary bits

0,1 and 2 to a binary number.

If the result of step 744 is negative, then the bit value is set equal to 1 in step 748. Control is then passed to step 743 to test whether the bit counter is set to odd or even. If set to odd, control is transferred to step 750 where the fixed code (which indicates that the bit is an odd bit in the sequence of frames rather than an even bit, meaning that it is one of the interleaved rolling code bits) is multiplied by three and then the bit value is added.

If the bit counter indicates that odd ternary bits are being processed, the existing rolling code register is multiplied by 3 and the ternary bit values obtained from

steps

742, 746, and 748 are then added. Whether step 750 or step 752 occurs, then the bit counter value is tested in step 754, as shown in FIG. 8E. If the bit counter value is greater than 21, the bit counter rolling code register and fixed code register are cleared in step 758, and the routine exits. If the bit counter value is less than 21, then a return is made from the interrupt sequence in step 756. If the bit counter value is equal to 21, indicating that a sink bit (sink bit) plus a ternary data bit has been received, then a test is made in step 760 to determine if the sink bit indicates a first frame or a second frame, if it indicates a first frame, the bit counter is cleared and set for second frame completion, then a return is made from the routine in step 762. In the event that the determination at step 760 indicates that a second frame is received, the scrolling contributions of the two frames are added together to form a complete, inverted scrolling code. The rolling code is then inverted or mirrored in step 764 to recover the rolling code counter value. A test is made in step 766 to determine if the program mode has been set. If so, control is transferred to step 768 and the code is compared to the last received code at step 768. If there is no match, another code will be read until two consecutive codes match, otherwise the program mode is terminated. At step 770, the code is tested such that the fixed code is tested for matching with the fixed code non-volatile memory. If there is a match, the scrolling part is stored in memory. If not, the scrolling portion is stored in non-volatile memory. Control is then transferred to step 772, the program indicator is turned off, program mode is exited, and return is made from the interrupt. In the event that the test at step 766 indicates that the program mode has not been set, the program indicator is turned on at step 774 as shown in FIG. 8F. In step 776, the code is tested to determine if there is a match for the fixed portion of the code. If not, the program indicator is turned off and the routine exits in step 778. If there is a match, the counter indicating the rolling code is tested to determine if its value is greater than the stored rolling code by a factor or by less than 3,000 (which indicates a time interval of 1000 button presses to the first device). If not, a test is made in step 786 to determine if the last transmission from the same first device has a rolling code two to four less than the received portion, and if true, whether the stored value minus the received rolling code counter value is greater than 1,000. If so, control is transferred to step 782 to turn off the program indicator and set the operating command word which causes the command signal to operate the garage door operator. The receive timeout timer is cleared and the rolling code counter value is stored in non-volatile memory, and the routine exits in step 784. If the difference is not greater than 1,000 in step 786, then a return is immediately made from the interrupt in step 784. In the event that the counter test in step 780 is positive, then steps 782 and 784 are performed thereafter.

Fig. 8G and 8H are a schematic diagram of bit processing and parsing (fig. 8G) and an example message diagram (fig. 8H) according to one example configuration to form an encrypted message. This provides an example where a fixed code portion and a variable (e.g., rolling) code portion may be used to form an encrypted message. Referring now to FIG. 8G, an illustrative embodiment of bit processing and parsing will be presented. In this example, the unique substantive content to be associated with and transmitted by the 28-bit rolling code 790 comprises a 40-bit value representing the fixed information 791. The fixed information 791 may, for example, be used to uniquely identify the transmitter that will ultimately transmit the information. In this embodiment, the resulting encrypted rolling code 793 is provided by encrypting 792 the bits comprising the rolling code 790 by mirroring those bits, and then converting those mirrored bits to ternary values as described above to provide corresponding bit pairs (which in this example would comprise 18 such bit pairs). The mirroring may be applied to a specific grouping of bits in the rolling code, creating a mirror group, or may refer to the entire value. In this illustrative example, the encrypted rolling codes 793 are presented as four groups for further processing. In this example, the four groups include a rolling group E793A of four binary bit pairs, a rolling group F793B of five binary bit pairs, a rolling group G793C of four binary bit pairs, and a rolling group H793D of five binary bit pairs.

Although there is no encryption in this embodiment, the 40-bit fixed information 791 is subdivided in a similar manner. In this particular illustrative method, this includes forming four sub-groups, including fixed group A794A, fixed group B794B, fixed group C794C, and fixed group D794D, where each such group consists of 10 bits of the original 40-bit value.

These differently partitioned data groups may then be used to cause the desired transmission as shown in fig. 8H. In this example, one or more unification messages 795 provide a primary propagation medium through which desired information (including encrypted rolling codes and fixed information data (which is modified according to a given portion of the encrypted rolling codes), as well as recovery identifiers representing the given portion of the encrypted rolling codes) is communicated. Generally, the join message 795 includes a first 20-bit portion 796 and a second 30-bit portion 797.

In this embodiment, the first portion 796 includes the following fields: "0000" -these bits 796A are used for the precharge decoding process and effectively establish the operational threshold; "1111" — these bits 796B contain two bit pairs that exhibit an illegal state "11" ("illegal" because it corresponds to the fourth unallocated state in the ternary context of these communications) and are used here as a basis for facilitating synchronization with the receiving platform; "00" -this bit pair 796C identifies the type of payload carried by the consolidated message (in this embodiment, "00" corresponds only to the fixed identification information of the transmitter itself and "01" corresponds to the complementData-only loads, "10" corresponds to supplemental data-only loads-see below for further explanation of these load types); "Xx"

This bit pair 796D represents a frame identifier that may be used by the receiver to determine whether all required joint messages 795 have been received, and may also be used to facilitate proper reconstruction of the transmitted data; "B3, B2, B1, B0" -these two-bit pairs 796E include an inversion mode recovery identifier and are selected from the bits comprising the encrypted rolling code 793 described above; "B7, B6, B5, B4" -these two-bit pairs 796F include a bit order pattern recovery identifier and are also selected from the bits comprising the encrypted rolling code 793 described above.

There are a number of ways in which these resume identifier values may be selected. By one approach, a specified number of bits may be selected from the encrypted rolling group to form a corresponding rolling subgroup. These may include, for example, encrypting the first or last eight bits (forward or reverse order) of the rolling group. These may also include, for example, any eight consecutive bits starting at any preselected bit position. Other possibilities also exist. For example, only even position bits or odd position bits may be suitable for this aspect. For example, it is also possible to use preselected bits as a subset of a rolling group comprising one or more of the previously described.

It is also possible to change the selection mechanism from, for example, a join message to a join message. By a simple approach in this regard, for example, the first eight bits of the encrypted rolling group 793 may be used to form the rolling subgroup, while the last eight bits of the encrypted rolling group 793 are used in a similar fashion in an alternating fashion. The bits comprising the rolling subset may then be further parsed to form two recovery identifiers. These recovery identifiers may be used in conjunction with one or more look-up tables to determine a data bit order pattern for formatting data to include a portion of a consolidated message. In some embodiments, the rolling group used to form the recovery identifier does not appear in the consolidated message.

Fig. 9A, 9B, and 9C are flowcharts of an interconnect showing more specific examples of the process discussed above with respect to fig. 4A-C. In this example, a first device (e.g., a handheld or in-vehicle transceiver) commands a second device (e.g., a garage door operator) to take an action through encrypted transmission of a rolling code. Throughout fig. 9A-C, "1F" refers to a first fixed code, "1R" refers to a first rolling code, "2F" refers to a second fixed code unrelated to 1F, and "2R" refers to a second rolling code unrelated to 1R. "1A", "2A", and "3A" each refer to an "added value" that represents a value added to the rolling code or one or more scrolls of the rolling code. 1A, 2A and 3A may be the same or different.

Initially, both the first and second devices have stored in their memories a first fixed code and a first variable code from a previous operation involving the first device, and a second fixed code and a second rolling code from a previous operation involving the second device. When a user activates a first device in a manner intended to cause a second device to act, such as by pressing an activation button (first step 801), the first device creates a first message that includes a first fixed code (1F) corresponding to the first device and a first changed version (1R +1A) of the first rolling code that represents the rolling code value from the previous operation as modified by a first changing protocol, i.e., an algorithm that cycles through a specified number of codes one by one or calculates a new value from an initial rolling code value. The changed code (1F1R +1A) is stored in the memory of the first device and is also encrypted using one or more encryption methods for transmission to the second device (step 803). At this time, the initial value of the rolling code (1R) may be optionally deleted from the device memory. The first device also determines 805 a time window (W) or delay in which to expect to receive a response. The time window (W) may be determined from one or both of the rolling code values (1R and/or 1R +1A) or a portion thereof, or from the encrypted message or a portion thereof. For example, 1R +1A may include a time within a particular portion of its sequence, or the first device may apply an algorithm to 1R +1A, or one or more portions thereof, to calculate the time value of W. For example, the transmission characteristics of the recovery identifier (e.g., 796E and/or 796F in fig. 8H), a portion of the encrypted change code portion (e.g., a portion 797 in fig. 8H), and/or a portion of the decrypted change code value may determine the beginning and end of the time window. The time window W may represent a relative time period (e.g., from a particular action such as an initial button press or a first encrypted signal transmission, at the beginning and end of a particular time interval) or an absolute time period (e.g., based on a time value from a time device of (or in communication with) the first device that is synchronized with a time device of (or in communication with) the second device).

The second device, which is in an operating mode and is waiting for a signal (step 802), receives a first encrypted message from the first device, decrypts the message to obtain the first fixed code and the first variable code (1F1R +1A) and stores the new values in its memory (step 804). The second device then compares the first fixed code and the first variable code (1F1R +1A) received from the first device to expected values based on the stored code values (e.g., by applying the same algorithm used by the first device to the previous first device value (1F 1R) stored in the memory of the second device) (step 806). When comparing the received value with the stored value, the second device will perform an authentication step 807. If the fixed code matches and the received first rolling code (1R +1A) matches the expected value based on the stored rolling code (1R), the second device will continue to communicate with the first device. To account for accidental triggering of the first and/or second devices, the use of multiple first devices with the second device, or other situations where the rolling code received from the first device may not exactly match the expected value, this verification step preferably compares the received rolling code (1R +1A) with a set number of values in a series of values that fall within the sequence before and/or after the expected value (i.e., within a window of specified size around the expected value), and if the received rolling code matches any value in the series, the message from the first device is considered valid. Thus, when one device is not within range of another device, activating it will not cause the two devices to lose synchronization altogether and make communication impossible. If the decrypted code value does not match the stored code value, the second device ignores the first message and returns to step 802.

If the received message is verified, the second device calculates 808 a response time window. As illustrated in fig. 9A, in step 805, the second device calculates the same time window (W) in the same manner as the first device calculates. In other embodiments, the window or delay calculated at step 808 may be different, such as a shorter time window within W, or a single point in time that falls with W, and may even be calculated or determined from 1R, 1R +1A, and/or different portions of the encrypted message.

In response to verifying the first encrypted message, and after determining the response time window, the second device transmits 810 a response within the calculated response time window. The response comprises a second encrypted message originating from a second fixed code (2F) and a second rolling code (2R +2A) corresponding to the second device, independent of the first variation code, and representing a modified version of the second variation code (2R) from the previous operation. These values are stored in the memory of the second device, so at this stage the second device memory contains the first fixed and variable code (1F 1R) from the previous operation, the second fixed and variable code (2F2R) from the previous operation, the first fixed and variable code (1F1R +1A) from the first encrypted message sent by the first device, and the second fixed and variable code (2F2R +2A) from the encrypted response.

The first device enables the receiver during the time window determined (step 809) by the first device so that it can receive the encrypted response from the second device if the response arrives at the first device within the determined time window (W). If the response is sent outside of Wo, or for some other reason reaches the first device outside of Wo, the response will be ignored because the first device receiver is inactive or programmed to ignore the input signal. Assuming the first device receives a response within W, the first device will decrypt the second encrypted message to determine a second fixed code and a second rolling code (2F, 2R +2A) (step 811). These values (2, 2R +2A), together with the second fixed and variable code (2F2R) from the previous operation and the first fixed and variable code (1F1R +1A) from the first encrypted message, are stored in the memory of the first device.

The first device then compares the second fixed code and the second rolling code (2F2R +2A) to the fixed code and the variable code (2F2R) from the previous operation stored in the memory of the first device (step 812). The first device will then perform a verification step (step 813) which is similar to the verification step performed by the second device at step 807. The response message is considered validated if the second fixed code matches the fixed code from the previous operation and the second variable code (2R 2A) matches the previous variable code modified according to a set of established variable code rules, taking into account a predetermined accepted amount of errors (e.g., a look-ahead window). If the second fixed code and variable code (2F2R +2A) are determined to be valid (step 813), the first device generates a message that includes at least the changed version of the first fixed code and the second rolling code (1F 2R +3A), encrypts the message by applying an algorithm (which may or may not be the same as the algorithm used at step 803 and/or step 810) to the rolling code value (2R +2A) received from the second device to create a third encrypted message, stores the new value in its memory, and transmits the third encrypted message to the second device (step 814). If the first device is unable to verify the response from the second device, the flow ends and the first device returns to waiting for subsequent activation (801).

The second device receives and decrypts 815 the third encrypted message to determine a changed version (1F 2R +3A) of the first fixed code and the second variable code. The second device then compares the fixed codes from the first and third encrypted transmissions to confirm that they were transmitted by the same first device, and compares the rolling code from the third encrypted message to an expected value based on the last stored value of the second rolling code (2R +2A from the second encrypted message) (step 816). In a verification step similar to those discussed above, the second device then determines 817 whether the third encrypted message is valid. If the third message is verified, the second device performs 818 the requested action associated with the activation of the first device. If the second device cannot verify the third message, it ends the flow without performing the requested action and returns to step 802 to wait for a signal from the first device.

Fig. 10A-C illustrate one example of a particular method of pairing a first device with a second device, which corresponds to the more general method illustrated in fig. 5A-C. In this example, a first device (e.g., a user-actuated device) and a second device (e.g., an operator device for performing a particular action) are synchronized in order to identify and verify a signal shared between the devices at both ends. Throughout fig. 10A-C, "1F" refers to a first fixed code, "1R" refers to a first rolling code, "2F" refers to a second fixed code unrelated to 1F, and "2R" refers to a second rolling code unrelated to 1R. "1A", "2A", and "3A" each refer to an "added value" that represents a value added to the rolling code or one or more scrolls of the rolling code. 1A, 2A, 3A may be the same or different. Each of these values need not be the same as those in fig. 9A-C.

The pairing process begins when the first device is activated (e.g., by a user pressing a button on the device) (step 851), while the second device has been placed in a "learn" mode (step 852) (e.g., by pressing a button or switching a joystick associated with the second device). First, the first device contains in its memory a first fixed code (1F) and a first variable code (in this case a rolling code 1R) which represent the initial values or values from previous operations of the first device, and the second device contains a second fixed code (2F) and a second variable code (in this case a rolling code 2R) which represent the initial values or values from previous operations. The fixed codes are respectively associated with and identify their respective devices, while the rolling codes are independent of each other. When the first apparatus is activated, it generates a first encrypted message from the first fixed code and a modified version of the first rolling code (1F1R +1A) (step 853), and determines a time window (W) based on the first rolling code or at least a portion of the first encrypted message, in order to expect a response from the second apparatus in the time window (W) (step 855). The time window may be defined by the first rolling code or a value within the first encrypted message, or may be calculated therefrom based on an algorithm. The first device receiver is enabled to receive a response from the second device during the time window (step 856).

Meanwhile, the second device receives the first encrypted message while the second device is in the learn mode (step 854), and stores the decrypted first fixed and first variable codes (1F1R +1A) from the first encrypted message (or portion thereof) in a memory of the second device (step 857). The second device determines a time window based on the first encrypted message and/or the first rolling code to transmit a response in the time window (step 858). The time window determined by the second apparatus may be the same as or within W determined by the first apparatus at step 855 and may be determined in the same or a different manner. The second device then transmits a response within the determined time window (step 859), the response including the encrypted versions of the second fixed code (2F) and the second rolling code (2R). Optionally, a second rolling code, independent of the first rolling code, may be included in the second encrypted message. The second rolling code may, for example, start with a minimum value, such as 00. If the first device receives the second encrypted message within the time period W calculated by the first device for the response, the second message is decrypted (step 860) and the first device stores the second fixed code (and optionally the second variable code if it was sent) (step 861). If no response is received from the first device within the time window, the message will be ignored and the pairing process stops, and the first and second devices return to

steps

851 and 852, respectively.

After receiving the response from the second apparatus within the time window W and storing the correlation values, and either being set to the learning mode by the activation switch or receiving the learning indicator from the second apparatus, the first apparatus then transmits a third encrypted message comprising at least the first fixed code (1F) and the changed version of the first changed code (1R +2A) (step 862). The first device also enables a receiver of the first device in anticipation of receiving further communications from the second device. In some embodiments, this step of enabling reception in the first apparatus (step 863) may comprise an associated time window derived from the third message.

When the second device receives and decrypts the third encrypted message (step 864), it validates the message by comparing the first fixed code and the changed version of the first changed code (1F1R +2A) with the expected value of the stored code value from the first encrypted message (step 865) (step 866). If the second device determines that the code (1F1R +2A) from the third cryptographic information is valid (step 866), the second device transmits a fourth cryptographic message in response to verifying the third cryptographic message, the fourth cryptographic message including a second fixed code and a second varying code (2F2R) (step 867).

The first device receives the fourth encrypted message (step 868) and verifies the fourth message by comparing the fixed code of the fourth message to the previously received fixed code (step 869). If the fixed codes are the same, indicating that both are from the second device, the fourth message is determined to be valid (step 870), and the first device stores the second fixed code and the second rolling code (2F2R) (step 871). The first device and the second device have now stored in their respective memories matching first fixed/rolling and second fixed/rolling code pairs (1F1R +2A and 2F2R) which are available as initial values (1F1R and 2F2R) in operation, such as shown in fig. 9A-9C.

The learning mode may operate at the same frequency as the operation mode, and may operate at multiple frequencies. In some embodiments, the first device and the second device communicate wirelessly via one or more frequencies, channels, frequency bands, and radio physical layers or protocols in the operational mode and/or the learning mode, including but not limited to, for example, 300MHz-400MHz, 900MHz, 2.4GHz, Wi-Fi/wlan, Bluetooth Low Energy (BLE), 3GPP GSM, UMTS, LTE-a, 5G NR, proprietary radio, and the like. In other embodiments, the first device and the second device communicate via a wired connection and various protocols in the operating mode and/or the learning mode, including but not limited to two (or more) wired serial communications, Universal Serial Bus (USB), inter-integrated circuit (I2C) protocol, ethernet, Control Area Network (CAN) vehicle bus, proprietary protocols, and the like. In some embodiments, the maximum distance between the first device and the second device may vary between the learning mode and the operating mode, while in other modes the maximum range in both modes will be the same due to the variation in the interference range.

While particular embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that a number of modifications, alterations, and combinations of the above examples are possible without departing from the scope of the invention, and that such modifications, alterations, and combinations are to be viewed as being within the ambit of the inventive concept.

Claims

1. A method of secure communication between a first device having a first memory and a second device having a second memory to cause an action of the second device, the method comprising:

transmitting a first encrypted message from the first apparatus to the second apparatus, the first encrypted message comprising at least a first fixed code and a first varying code;

the first device determining a first time window based on at least one of (i) at least a portion of the first encrypted message and (ii) at least a portion of the first change code, such that a response to the first encrypted message is expected in the first time window, the response being sent from the second device;

the second device receiving the first encrypted message;

the second device verifies the first encrypted message by comparing the first fixed code and the first varying code to a first stored code value stored in the second memory;

the second device determining a second time window based on the first encrypted message to transmit the response from the second device in the second time window;

transmitting the response from the second apparatus within the second time window in response to verifying the first encrypted message, wherein the response comprises a second encrypted message comprising a second fixed code and a second varying code;

the first device receiving the response from the second device within the first time window;

the first device verifies the response by comparing the second fixed code and the second varying code to a second stored code value stored in the first memory;

after verifying the response, the first device transmitting a third encrypted message comprising at least the changed versions of the first fixed code and the second changing code;

the second device receiving the third encrypted message;

the second device verifying the third encrypted message by comparing the changed versions of the first fixed code and the second changed code to a stored code value;

in response to verifying the third encrypted message, the second device performs an action.

2. The method of claim 1, wherein the first time window and the second time window are the same.

3. The method of claim 1, wherein the second time window is within the first time window.

4. The method of claim 1, further comprising enabling a receiver of the first apparatus to receive a transmission from the second apparatus within the first time window.

5. The method of claim 4, wherein enabling the receiver of the first apparatus comprises turning on the receiver.

6. The method of claim 4, wherein enabling the receiver comprises commanding the receiver to process an incoming transmission.

7. The method of claim 1, further comprising determining whether the response from the second apparatus was received within the first time window.

8. The method of claim 1, wherein the second time window is a discrete point in time.

9. The method of claim 1, wherein the first fixed code uniquely identifies the first device and the second fixed code uniquely identifies the second device.

10. The method of claim 1, wherein the second stored code value stored in the first memory comprises a previous fixed code and a previous varying code from a previous communication between the first apparatus and the second apparatus.

11. The method of claim 10, wherein comparing the second fixed code and the second varying code to the second stored code value comprises: determining whether the second fixed code matches the previous fixed code and whether the second varying code corresponds to the previous varying code.

12. The method of claim 1, wherein transmitting the first encrypted message from the first apparatus to the second apparatus comprises: wirelessly transmitting the first encrypted message using a radio frequency signal.

13. The method of claim 1, wherein the first device comprises a vehicle-mounted transmitter and the second device comprises a movable barrier operator.

14. A system for secure communication between a first device and a second device to cause an action by the second device, the system comprising:

the first device comprises:

a controller circuit;

a transmitter in operable communication with the controller circuit;

a receiver in operable communication with the controller circuit;

a user input device in operable communication with the controller circuit;

wherein the controller circuit is configured to:

in response to detecting an input at the user input device, controlling the transmitter to transmit a first encrypted message, the first encrypted message comprising at least a first fixed code and a first varying code;

receiving, by a receiver, a response from the second apparatus, wherein the response comprises a second encrypted message comprising a second fixed code and a second varying code;

validating the response by comparing the second fixed code and the second varying code to a second stored code value;

in response to verifying the response, controlling the transmitter to transmit a third encrypted message comprising at least the changed versions of the first fixed code and the second change code, wherein the third encrypted message is configured to cause the second apparatus to perform an action;

the second device includes:

a second controller circuit;

a second transmitter in operable communication with the second controller circuit;

a second receiver in operable communication with the second controller circuit;

a timer circuit in operable communication with the second controller circuit;

wherein the second controller circuit is configured to:

enabling a receiver of the second device to receive the first encrypted message;

verifying the first encrypted message by comparing the first fixed code and the first varying code to a stored code value;

determining a time window based on the first encrypted message to transmit the response in the time window;

controlling transmission of the response from the transmitter of the second apparatus within the time window by tracking the time window using the timer circuit in response to verifying the first encrypted message;

enabling the second receiver to receive the third encrypted message;

verifying the third encrypted message by comparing the changed versions of the first fixed code and the second changing code to a stored code value;

in response to verifying the third encrypted message, performing an action.

15. The system of claim 14, wherein the first device comprises a first device timer circuit in communication with the controller circuit, the controller circuit configured to determine a first time window based on at least a portion of the first encrypted message, the controller circuit configured to expect a response from the second device within the first time window.

16. The system of claim 15, wherein the controller circuit of the first device is configured to verify the response of the second device based at least in part on whether the response is received within the first time window.

17. The system of claim 14, wherein the first fixed code uniquely identifies the first device and the second fixed code uniquely identifies the second device.

18. The system of claim 14, wherein the second stored code value comprises a previous fixed code and a previous changed code from a previous communication between the first apparatus and the second apparatus.

19. The system of claim 18, wherein the controller circuit of the first device is configured to: comparing the second fixed code and the second varying code to the second stored code value by determining whether the second fixed code matches the previous fixed code and whether the second varying code corresponds to the previous varying code.

20. The system of claim 14, wherein the controller circuit is configured to: control the transmitter to wirelessly transmit the first encrypted message using a radio frequency signal.